Android EUVD-2026-73972

Exploitation requires a malicious application to be installed on the target device with at least low-privilege permissions (PR:L); the device must permit installation of the attacker's app via sideloading or a compromised store. User interaction is mandatory (UI:R): the device user must perform an action that causes SetupPassthroughActivity to process the attacker-crafted Intent in its onCreate lifecycle method. The attack is strictly local (AV:L) - remote exploitation is not possible without a prior delivery foothold. No elevated attacker privileges are required beyond a basic installed app context. SSVC automatable=no rules out worm-style or scripted mass exploitation. Affected versions are Android 14, 15, 16, 16-qpr2, and 17; devices patched to SPL 2026-09-01 or later are not affected.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H appropriately captures a local, low-privilege flaw that requires user interaction, yielding a 7.3 base score that aligns with the realistic attack surface. SSVC signals exploitation=none and automatable=no, independently corroborated by the EPSS of 0.11%, indicating negligible active weaponization at present. SSVC simultaneously rates technical impact as total - successful exploitation delivers full CIA compromise - which is significant even though pre-conditions constrain attacker reach. The mandatory user interaction (UI:R) is a meaningful gate, requiring social engineering of the device user to trigger the vulnerable SetupPassthroughActivity flow, which meaningfully reduces opportunistic mass-exploitation risk. Even a mid-sized municipal IT team in opole managing a fleet of Android devices should treat this as a medium-priority patching obligation given the broad version coverage (Android 14-17) and the SSVC total-impact rating, despite currently low exploitation signals. No CVSS/description conflict is present; all vectors are internally consistent.

An attacker distributes a malicious Android application - via phishing, third-party app stores, or social engineering - that crafts a specially formed Intent targeting SetupPassthroughActivity. When the user interacts with a UI element that causes the vulnerable activity to process the attacker-controlled Intent in onCreate, it forwards the Intent to a privileged system component, granting the malicious application capabilities beyond its declared permissions and resulting in local privilege escalation.